This notice explains what personal data ILLÆSA collects through illaesa.com, why we collect it, and what rights you have. We have written it to be read, not to be survived.
Who we are
ILLAESA LIMITED (“ILLÆSA”, “we”, “us”) is a supply chain due diligence and sustainability consultancy based in Hong Kong SAR. We are the data user under the Hong Kong Personal Data (Privacy) Ordinance, and the data controller for the purposes of the EU and UK General Data Protection Regulation where those apply to us.
You can reach us about anything in this notice at hello@illaesa.com, or by post at Unit 7, 8/F., Tower B, 83 King Lam Street, Lai Chi Kok, Hong Kong.
What we collect
If you use the contact form, we collect the name, email address, organisation and message you choose to give us. Organisation is optional; the rest are needed for us to reply.
If you join our mailing list, we collect your email address and nothing else.
Our host, Cloudflare, records standard server and security logs — IP address, request time, user agent — for the purpose of serving and protecting the site. Cloudflare may set strictly necessary security cookies as part of that protection.
Beyond that, this site does not track you. There are no analytics, no advertising or social-media pixels, no third-party cookies, and no profiling. Our fonts are served from our own domain rather than from a font network, so loading a page does not disclose your visit to anyone else.
Why we use it, and on what basis
We use contact-form data solely to read and answer your enquiry, and to keep a record of the correspondence. Where the GDPR applies, our basis is our legitimate interest in responding to people who ask us to, and where relevant the steps taken at your request before entering a contract.
We use mailing-list addresses solely to send you our own material. Where the GDPR applies, our basis is your consent, which you gave when you submitted the form and which you can withdraw at any time.
Direct marketing
This section is our notification to you under Part 6A of the Hong Kong Personal Data (Privacy) Ordinance.
We intend to use your email address in direct marketing. We may not so use it unless we have received your consent to that use. The only kind of personal data we use for this is your email address, and where you have given it, your name. The classes of marketing subjects are our own updates, written perspectives, research and occasional event invitations, all concerning supply chain due diligence, human rights and sustainability. We market only our own services; we do not market anyone else’s.
We will not provide your personal data to any other person for that person’s use in direct marketing, whether for gain or otherwise.
You may require us to stop using your personal data in direct marketing at any time, without charge. Use the unsubscribe link in any email we send you, or write to hello@illaesa.com with the word “unsubscribe”. We will act on it promptly and will not ask you to justify it.
If you have only written to us through the contact form, you are not on the mailing list. We do not move enquiry addresses onto the list. If you want to be on it, you have to ask.
Who else handles it
Our forms are processed by Web3Forms, which receives your submission and forwards it to us by email. Web3Forms is operated from India and stores submissions on infrastructure provided by Amazon Web Services, Hetzner and Cloudflare, encrypted at rest, for up to three years. It acts on our instructions as a processor and does not use your data for its own purposes.
Our site is hosted and delivered by Cloudflare.
We use ordinary business email to correspond with you, which means your message reaches our email provider in the normal way.
This means personal data you give us may be transferred outside the jurisdiction you are in, including to Hong Kong, India, the European Economic Area and the United States. Where the GDPR applies to a transfer, we rely on the standard contractual clauses or another approved safeguard offered by the processor concerned.
How long we keep it
We keep enquiry correspondence for as long as needed to deal with the matter and for a reasonable period afterwards in case you come back to us, and then we delete it. We keep mailing-list addresses until you unsubscribe or until the list is closed, after which we retain only the minimum record needed to make sure we do not contact you again by mistake.
Your rights
Under the Hong Kong Ordinance you may ask us whether we hold personal data about you, request a copy of it, and request that we correct anything inaccurate. We will respond within 40 days.
Where the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time without affecting the lawfulness of what we did before you withdrew it.
To exercise any of these, write to hello@illaesa.com. We do not charge for this.
Complaints
If you think we have handled your data badly, please tell us first — we would rather fix it. You also have the right to complain to a regulator: the Office of the Privacy Commissioner for Personal Data, Hong Kong; in the United Kingdom, the Information Commissioner’s Office; and in the European Economic Area, your national supervisory authority.
Changes
If we change how we handle personal data, we will update this page and the date at the top. Material changes affecting the mailing list will be notified to subscribers by email.